Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
11/09/2024, 04:16
General
-
Target
CheatEngine75.exe
-
Size
28.6MB
-
MD5
c0b4fec8ef1a3a96c25952d1711f14bb
-
SHA1
b3951161dd9a163b60c6f2d7ac28435f1b8d0d64
-
SHA256
1677bc66ed7f88e9c69b31b50b5cc8a92466f01db7f422c06ae5632ec19437ef
-
SHA512
94dc06b3d6d45aee1e52ca1be3c76e6b4d862930db037e627c086613adc15aa4f036c27bd300094176fe9d5ab421d44ad2819da7acad9af602de1f648c05c8e0
-
SSDEEP
786432:UTCxuEnwFho+zM77UDZiZCd08jFZJAI5E70TZFHHq:U2EXFhV0KAcNjxAItjK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks for any installed AV software in registry 1 TTPs 9 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GD8A3.tmp\CheatEngine75.tmp"C:\Users\Admin\AppData\Local\Temp\is-GD8A3.tmp\CheatEngine75.tmp" /SL5="$C0168,29071676,832512,C:\Users\Admin\AppData\Local\Temp\CheatEngine75.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD58d9b9796b574d145614d27a8729ccc67
SHA1e38ec447a1687cb5bb21a1ed887e83cd8f35d836
SHA25658407a41b4c4c4b88d0b8b0ccf5b641102d00c48c3443185c72ba10dcddecc07
SHA512855483eff0c38ebf9575dab1241ed8c74075765ed88b1b3450d2cdf2a469d6beeb013f182b2ff4c1bd81bf2d26f061b72f4dff74c871414b44c701df7855e2a5
-
Filesize
246KB
MD5f3d1b8cd125a67bafe54b8f31dda1ccd
SHA11c6b6bf1e785ad80fc7e9131a1d7acbba88e8303
SHA25621dfa1ff331794fcb921695134a3ba1174d03ee7f1e3d69f4b1a3581fccd2cdf
SHA512c57d36daa20b1827b2f8f9f98c9fd4696579de0de43f9bbeef63a544561a5f50648cc69220d9e8049164df97cb4b2176963089e14d58a6369d490d8c04354401
-
Filesize
2.0MB
MD5b83f5833e96c2eb13f14dcca805d51a1
SHA19976b0a6ef3dabeab064b188d77d870dcdaf086d
SHA25600e667b838a4125c8cf847936168bb77bb54580bc05669330cb32c0377c4a401
SHA5128641b351e28b3c61ed6762adbca165f4a5f2ee26a023fd74dd2102a6258c0f22e91b78f4a3e9fba6094b68096001de21f10d6495f497580847103c428d30f7bb
-
Filesize
3.1MB
-
Filesize
1.2MB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
864KB
-
Filesize
728KB
-
Filesize
864KB
